1CentOS 9: kernel-5.14.0-529.el9
high Nessus 插件 ID 211516
语言：
简介
远程 CentOS 主机缺少一个或多个 bpftool 安全更新。描述
远程 CentOS Linux 9 主机上安装的多个程序包受到 kernel-5.14.0-529.el9 版本变更日志中提及的多个漏洞影响。- Linux 内核中的以下漏洞已修复：ipvs: ip_vs_add_service 中正确取消引用 pe。直接使用 pe 解决稀疏警告：net/netfilter/ipvs/ip_vs_ctl.c:1471:27：
警告：noderef 表达式取消引用 (CVE-2024-42322)
- Linux 内核中的以下漏洞已修复：fscache：退出 fscache 时删除 fscache_cookie_lru_timer 以避免 UAF fscache_cookie_lru_timer 在插入 fscache 模块时会初始化，但在移除 fscache 模块时未删除。如果在删除 fscache 模块之前调用 timer_reduce()，fscache_cookie_lru_timer 将添加到当前 cpu 的定时器列表中。之后，删除 fscache 模块之后，将在 softIRQ 中触发释放重引用，如下所示：=========================== ======================================= 缺陷：无法处理以下地址的页面错误：ffffbfff803c9e9 PF：内核模式 PF：
error_code(0x0000) - 不存在页面 PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops：
Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855 Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace: <IRQ> tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0 handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60 do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148 </TASK> Modules linked in: [last unloaded: netfs] ================================================== ============= 因此，在删除 fscahe 模块时会删除 fscache_cookie_lru_timer。 (CVE-2024-46786)
- Linux 内核中的以下漏洞已修复：NFSD：限制并发异步 COPY 操作的数量。似乎没有任何内容可以限制客户端可启动的并发异步 COPY 操作的数量。此外，AFAICT 每个异步 COPY 可复制无限数量的 4MB 区块，因此可以运行很长时间。因此，IMO 异步 COPY 可转变为 DoS 矢量。添加限制机制，限制并发后台 COPY 操作的数量。简单开始，力争公平 -- 此补丁将对各命名空间进行限制。超出此限制时发生的异步 COPY 请求将返回 NFS4ERR_DELAY。
发出请求的客户端可以选择在延迟后再次发送请求，或回退到使用传统的读取/写入式复制。如需使该机制更复杂，可在以后的补丁中加以利用。 (CVE-2024-49974)
- Linux 内核中的以下漏洞已修复：netfilter：xtables：在需要的情况下避免 NFPROTO_UNSPEC syzbot 设法通过 ebtables 调用 xt_cluster 匹配：警告：CPU：0 PID：11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+ 0x196/0x780 [..] ebt_do_table+0x174b/0x2a40 模块注册到 NFPROTO_UNSPEC，但其假设处理的是 ipv4/ipv6 数据包。由于此项仅可用于限制本地终止 TCP/UDP 流量，因此仅为 ipv4 和 ipv6 系列注册此项。Pablo 指出这是一个普遍的问题，因为 set/getsockopt 接口的直接用户可能调用只与 ip(6) 表一起使用的目标/匹配。检查所有 UNSPEC 匹配和目标中的类似问题： - 匹配和目标正常，除非假设 skb_network_header() 有效 -- 仅当从 inet 层调用时才有效：ip(6) 堆栈将 ip/ipv6 标头提取到线性中数据区。 - 返回 XT_CONTINUE 或其他 xtables 判定的目标也必须受到限制，它们与 ebtables 遍历器不兼容，例如 EBT_CONTINUE 是与 XT_CONTINUE 完全不同的值。大多数 matches/target 都已更改为针对 NFPROTO_IPV4/IPV6 进行注册，因为其本身就为 ip(6)tables 所使用。MARK 目标也由 arptables 使用，因此也为 NFPROTO_ARP 注册。此时，如果 connbytes 无法启用相应的 conntrack 系列，则终止操作 。此变更通过 iptables.git 中的自我测试。 (CVE-2024-50038)
- Linux 内核中的以下漏洞已修复：platform/x86/intel/pmc：修复 pmc_core_iounmap 为有效地址调用 iounmap：当 iounmap 的地址范围无效时，提交 50c6dbdfd16e（x86/ioremap：改进 iounmap() 地址范围检查）引入一个 WARN。该情况在 Thinkpad P1 Gen 7 (Meteor Lake-P) 上会造成出现以下警告：WARNING: CPU: 7 PID: 713 at arch/x86/mm/ioremap.c:461 iounmap+0x58/0x1f0 Modules linked in: rfkill(+) snd_timer(+) fjes(+) snd soundcore intel_pmc_core(+) int3403_thermal(+) int340x_thermal_zone intel_vsec pmt_telemetry acpi_pad pmt_class acpi_tad int3400_thermal acpi_thermal_rel joydev loop nfnetlink zram xe drm_suballoc_helper nouveau i915 mxm_wmi drm_ttm_helper gpu_sched drm_gpuvm drm_exec drm_buddy i2c_algo_bit crct10dif_pclmul crc32_pclmul ttm crc32c_intel polyval_clmulni rtsx_pci_sdmmc ucsi_acpi polyval_generic mmc_core hid_multitouch drm_display_helper ghash_clmulni_intel typec_ucsi nvme sha512_ssse3 video sha256_ssse3 nvme_core intel_vpu sha1_ssse3 rtsx_pci cec typec nvme_auth i2c_hid_acpi i2c_hid wmi pinctrl_meteorlake serio_raw ip6_tables ip_tables fuse CPU: 7 UID: 0 PID: 713 Comm: (udev-worker) Not tainted 6.12.0-rc2iounmap+ #42 Hardware name: LENOVO 21KWCTO1WW/21KWCTO1WW, BIOS N48ET19W (1.06 ) 07/18/2024 RIP:
0010:iounmap+0x58/0x1f0 Code: 85 6a 01 00 00 48 8b 05 e6 e2 28 04 48 39 c5 72 19 eb 26 cc cc cc 48 ba 00 00 00 00 00 00 32 00 48 8d 44 02 ff 48 39 c5 72 23 <0f> 0b 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 ba 00 00 00 00 00 RSP: 0018:ffff888131eff038 EFLAGS: 00010207 RAX: ffffc90000000000 RBX: 0000000000000000 RCX:
ffff888e33b80000 RDX: dffffc0000000000 RSI: ffff888e33bc29c0 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8881598a8000 R09: ffff888e2ccedc10 R10: 0000000000000003 R11: ffffffffb3367634 R12:
00000000fe000000 R13: ffff888101d0da28 R14: ffffffffc2e437e0 R15: ffff888110b03b28 FS:
00007f3c1d4b3980(0000) GS:ffff888e33b80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00005651cfc93578 CR3: 0000000124e4c002 CR4: 0000000000f70ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7:
0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0xb6/0x176 ? iounmap+0x58/0x1f0 ? report_bug+0x1f4/0x2b0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? iounmap+0x58/0x1f0 pmc_core_ssram_get_pmc+0x477/0x6c0 [intel_pmc_core] ?
__pfx_pmc_core_ssram_get_pmc+0x10/0x10 [intel_pmc_core] ? __pfx_do_pci_enable_device+0x10/0x10 ? pci_wait_for_pending+0x60/0x110 ? pci_enable_device_flags+0x1e3/0x2e0 ? __pfx_mtl_core_init+0x10/0x10 [intel_pmc_core] pmc_core_ssram_init+0x7f/0x110 [intel_pmc_core] mtl_core_init+0xda/0x130 [intel_pmc_core] ? __mutex_init+0xb9/0x130 pmc_core_probe+0x27e/0x10b0 [intel_pmc_core] ? _raw_spin_lock_irqsave+0x96/0xf0 ? __pfx_pmc_core_probe+0x10/0x10 [intel_pmc_core] ? __pfx_mutex_unlock+0x10/0x10 ?
__pfx_mutex_lock+0x10/0x10 ? device_pm_check_callbacks+0x82/0x370 ? acpi_dev_pm_attach+0x234/0x2b0 platform_probe+0x9f/0x150 really_probe+0x1e0/0x8a0 __driver_probe_device+0x18c/0x370 ?
__pfx___driver_attach+0x10/0x10 driver_probe_device+0x4a/0x120 __driver_attach+0x190/0x4a0 ?
__pfx___driver_attach+0x10/0x10 bus_for_each_dev+0x103/0x180 ? __pfx_bus_for_each_dev+0x10/0x10 ? klist_add_tail+0x136/0x270 bus_add_driver+0x2fc/0x540 driver_register+0x1a5/0x360 ?
__pfx_pmc_core_driver_init+0x10/0x10 [intel_pmc_core] do_one_initcall+0xa4/0x380 ?
__pfx_do_one_initcall+0x10/0x10 ? kasan_unpoison+0x44/0x70 do_init_module+0x296/0x800 load_module+0x5090/0x6ce0 ? __pfx_load_module+0x10/0x10 ? ima_post_read_file+0x193/0x200 ?
__pfx_ima_post_read_file+0x10/0x10 ? rw_verify_area+0x152/0x4c0 ? kernel_read_file+0x257/0x750 ?
__pfx_kernel_read_file+0x10/0x10 ? __pfx_filemap_get_read_batch+0x10/0x10 ? init_module_from_file+0xd1/0x130 init_module_from_file+0xd1/0x130 ? __pfx_init_module_from_file+0x10/0
---truncated--- (CVE-2024-50107)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
更新 CentOS 9 Stream bpftool 程序包。另见
https://kojihub.stream.centos.org/koji/buildinfo?buildID=71625
插件详情
严重性: High
ID: 211516
文件名: centos9_kernel-5_14_0-529_71625.nasl
版本: 1.1
类型: local
代理: unix
发布时间: 2024/11/18
最近更新时间: 2024/11/18
支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
风险信息
VPR
风险因素: Medium
分数: 6.7
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5
矢量: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 分数来源: CVE-2024-46786
CVSS v3
风险因素: High
基本分数: 7.8
时间分数: 6.8
矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:U/RL:O/RC:C
漏洞信息
CPE: p-cpe:/a:centos:centos:kernel-64k-modules-extra, p-cpe:/a:centos:centos:rtla, p-cpe:/a:centos:centos:kernel-64k-debug-devel, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-internal, p-cpe:/a:centos:centos:kernel-64k-debug-modules-core, p-cpe:/a:centos:centos:kernel-64k-debug-core, p-cpe:/a:centos:centos:kernel-headers, p-cpe:/a:centos:centos:kernel-rt-modules-internal, p-cpe:/a:centos:centos:kernel-64k-modules-internal, p-cpe:/a:centos:centos:libperf, p-cpe:/a:centos:centos:kernel-rt-devel, p-cpe:/a:centos:centos:kernel-64k-debug-modules-internal, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-core, p-cpe:/a:centos:centos:kernel-rt-debug-devel-matched, p-cpe:/a:centos:centos:kernel-64k, p-cpe:/a:centos:centos:bpftool, p-cpe:/a:centos:centos:kernel-core, p-cpe:/a:centos:centos:kernel-debug-modules-core, p-cpe:/a:centos:centos:kernel-rt-devel-matched, p-cpe:/a:centos:centos:kernel-rt-core, p-cpe:/a:centos:centos:kernel-debug-uki-virt-addons, p-cpe:/a:centos:centos:kernel-zfcpdump, p-cpe:/a:centos:centos:kernel-rt-kvm, p-cpe:/a:centos:centos:kernel-64k-devel-matched, p-cpe:/a:centos:centos:kernel-modules-extra, p-cpe:/a:centos:centos:kernel-cross-headers, p-cpe:/a:centos:centos:kernel-64k-debug-modules-extra, p-cpe:/a:centos:centos:kernel-tools-libs, p-cpe:/a:centos:centos:kernel-debug-modules, p-cpe:/a:centos:centos:kernel-rt-debug-kvm, p-cpe:/a:centos:centos:kernel-rt-debug-devel, p-cpe:/a:centos:centos:kernel-debug-devel-matched, p-cpe:/a:centos:centos:kernel-rt-modules, p-cpe:/a:centos:centos:kernel-tools, p-cpe:/a:centos:centos:kernel-abi-stablelists, p-cpe:/a:centos:centos:kernel-zfcpdump-devel, p-cpe:/a:centos:centos:kernel-rt-debug-modules, p-cpe:/a:centos:centos:kernel-uki-virt, p-cpe:/a:centos:centos:kernel-64k-debug, p-cpe:/a:centos:centos:rv, p-cpe:/a:centos:centos:kernel-modules-partner, p-cpe:/a:centos:centos:kernel-rt-debug-modules-extra, p-cpe:/a:centos:centos:kernel-zfcpdump-core, p-cpe:/a:centos:centos:libperf-devel, p-cpe:/a:centos:centos:kernel-zfcpdump-modules, p-cpe:/a:centos:centos:kernel-rt-debug-modules-internal, p-cpe:/a:centos:centos:kernel-64k-modules-core, p-cpe:/a:centos:centos:kernel-64k-modules-partner, p-cpe:/a:centos:centos:kernel-64k-modules, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-partner, p-cpe:/a:centos:centos:kernel-64k-devel, p-cpe:/a:centos:centos:kernel-debug-devel, p-cpe:/a:centos:centos:kernel-zfcpdump-devel-matched, p-cpe:/a:centos:centos:kernel-rt-debug, p-cpe:/a:centos:centos:kernel-64k-debug-modules, p-cpe:/a:centos:centos:kernel-modules, p-cpe:/a:centos:centos:kernel-devel, p-cpe:/a:centos:centos:kernel-rt-modules-extra, p-cpe:/a:centos:centos:kernel-64k-debug-modules-partner, p-cpe:/a:centos:centos:kernel-tools-libs-devel, p-cpe:/a:centos:centos:kernel-64k-core, p-cpe:/a:centos:centos:kernel-debug-uki-virt, p-cpe:/a:centos:centos:kernel-debug, p-cpe:/a:centos:centos:kernel-selftests-internal, p-cpe:/a:centos:centos:perf, p-cpe:/a:centos:centos:kernel, p-cpe:/a:centos:centos:kernel-ipaclones-internal, p-cpe:/a:centos:centos:kernel-modules-core, p-cpe:/a:centos:centos:kernel-uki-virt-addons, p-cpe:/a:centos:centos:kernel-rt-modules-core, p-cpe:/a:centos:centos:kernel-debug-core, p-cpe:/a:centos:centos:kernel-debug-modules-internal, p-cpe:/a:centos:centos:kernel-rt-debug-modules-core, p-cpe:/a:centos:centos:kernel-rt-modules-partner, cpe:/a:centos:centos:9, p-cpe:/a:centos:centos:kernel-modules-internal, p-cpe:/a:centos:centos:kernel-rt-debug-core, p-cpe:/a:centos:centos:kernel-64k-debug-devel-matched, p-cpe:/a:centos:centos:kernel-rt-debug-modules-partner, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-extra, p-cpe:/a:centos:centos:kernel-debug-modules-partner, p-cpe:/a:centos:centos:kernel-debug-modules-extra, p-cpe:/a:centos:centos:kernel-devel-matched, p-cpe:/a:centos:centos:python3-perf, p-cpe:/a:centos:centos:kernel-rt
必需的 KB 项: Host/local_checks_enabled, Host/cpu, Host/CentOS/release, Host/CentOS/rpm-list
易利用性: No known exploits are available
补丁发布日期: 2024/11/14
漏洞发布日期: 2024/8/17
参考资料信息
CVE: CVE-2024-42322, CVE-2024-46786, CVE-2024-49974, CVE-2024-50038, CVE-2024-50107